Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions articles/6-business-benefits-of-apple-mdm-explained.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# 6 business benefits of Apple MDM, explained

The Apple [Mobile Device Management](https://support.apple.com/guide/deployment/intro-to-apple-platform-deployment-dep2c1b2a43a/web) (MDM) protocol provides remote management capabilities organizations need to configure and secure Apple devices like Macs, iPhones, iPads, Apple TV and even Apple Watch. Combined with Apple Business Manager or Apple School Manager (ABM / ASM) organizations can achieve scalable zero-touch enrollment, automated provisioning and comprehensive security enforcement resulting in fast, simplified device deployment across distributed workforces.
The Apple [Mobile Device Management](https://support.apple.com/guide/deployment/intro-to-apple-platform-deployment-dep2c1b2a43a/web) (MDM) protocol provides remote management capabilities organizations need to configure and secure Apple devices like Macs, iPhones, iPads, Apple TV and even Apple Watch. Combined with Apple Business or Apple School Manager (AB / ASM) organizations can achieve scalable zero-touch enrollment, automated provisioning and comprehensive security enforcement resulting in fast, simplified device deployment across distributed workforces.

## What is Apple Mobile Device Management (MDM)?

Expand Down Expand Up @@ -117,7 +117,7 @@ Employees think about their work rather than fighting with the device that been

## Getting started with Apple MDM

[Fleet](https://fleetdm.com/device-management) provides enterprise-grade MDM with API-first architecture, real-time device reporting, and cross-platform support for Mac, Windows, and Linux. It also integrates with Apple Business Manager for zero-touch deployment while maintaining complete data transparency. [Schedule a demo](https://fleetdm.com/contact) to see how open device management works without vendor lock-in.
[Fleet](https://fleetdm.com/device-management) provides enterprise-grade MDM with API-first architecture, real-time device reporting, and cross-platform support for Mac, Windows, and Linux. It also integrates with Apple Business for zero-touch deployment while maintaining complete data transparency. [Schedule a demo](https://fleetdm.com/contact) to see how open device management works without vendor lock-in.

<meta name="articleTitle" value="6 business benefits of Apple MDM, explained">
<meta name="authorFullName" value="Brock Walters">
Expand Down
8 changes: 4 additions & 4 deletions articles/apple-device-enrollment-program.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ This article covers how ADE works, which devices qualify, security controls, and

## Automated Device Enrollment overview

ADE links devices purchased through authorized channels to your organization in Apple Business Manager (ABM) before they reach employees, allowing them to ship directly to end users. When users power on their devices for the first time and connect to the internet, automatic MDM enrollment begins. Users complete Setup Assistant screens while device configuration applies from your [MDM server](https://fleetdm.com/device-management) in the background.
ADE links devices purchased through authorized channels to your organization in Apple Business (AB) before they reach employees, allowing them to ship directly to end users. When users power on their devices for the first time and connect to the internet, automatic MDM enrollment begins. Users complete Setup Assistant screens while device configuration applies from your [MDM server](https://fleetdm.com/device-management) in the background.

Apple originally launched this capability in 2014 as the Device Enrollment Program and rebranded it to Automated Device Enrollment (ADE) in December 2019 alongside the launch of ABM. The underlying technology remained the same, but the new name better describes what the system actually does.

Expand Down Expand Up @@ -79,7 +79,7 @@ ADE is an enrollment mechanism configured through ABM, not a complete management

When evaluating MDM vendors for ADE compatibility, you need to verify several technical requirements. Check that the platform supports Apple Push Notification certificate management with annual renewal processes, offers Setup Assistant customization options that let you control the enrollment experience, and can handle multiple MDM servers if your organization needs different management systems for different regions or business units.

When migrating from one management service to another, if your devices are on older versions of Apple operating systems they may need to be completely erased to re-enroll. If possible, admins should ensure all devices are on the latest Apple OS version. [Managed Device Migration](https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web) announced at [WWDC 2025](https://fleetdm.com/announcements/mdm-just-got-better) allows computers and mobile devices to be migrated without erasing simply by moving device records from one virtual MDM server to another in Apple Business manager. Limited tests of migration behavior on test devices before comitting to your entire fleet will determine if OS updates are needed.
When migrating from one management service to another, if your devices are on older versions of Apple operating systems they may need to be completely erased to re-enroll. If possible, admins should ensure all devices are on the latest Apple OS version. [Managed Device Migration](https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web) announced at [WWDC 2025](https://fleetdm.com/announcements/mdm-just-got-better) allows computers and mobile devices to be migrated without erasing simply by moving device records from one virtual MDM server to another in Apple Business. Limited tests of migration behavior on test devices before comitting to your entire fleet will determine if OS updates are needed.

Cross-platform capabilities also matter if you manage more than just Apple devices. Organizations with mixed device environments benefit from MDM platforms that handle Mac, Windows, and [Linux](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-linux-devices-into-fleet) from a single console rather than juggling separate management tools. [Fleet](http://fleetdm.com) supports ADE enrollment for Mac, iPhone, and iPad devices while also managing Windows and Linux endpoints. Its open-source model provides complete code transparency so you can verify exactly how devices are managed, and self-hosting options let you maintain full control over where device data lives.

Expand All @@ -89,13 +89,13 @@ Setting up ADE requires some upfront preparation to ensure smooth deployment. Yo

You should start by confirming you have these essential prerequisites in place:

* Apple Business Manager account with D-U-N-S number and domain verification
* Apple Business account with D-U-N-S number and domain verification
* [MDM vendor](http://fleetdm.com) supporting ADE enrollment and APNs certificate management
* Authorized reseller relationships for automatic device registration
* Network infrastructure permitting connections to Apple servers without SSL/TLS inspection
* Certificate renewal procedures using the same Apple ID for annual APNs renewal

Beyond technical infrastructure, configuration planning determines how users experience enrollment. You need to define enrollment profiles that specify which Setup Assistant screens users see during initial setup, establish device naming conventions that make sense for your IT team, and create department-specific configurations for different user groups. Make sure to assign these profiles in Apple Business Manager before distributing devices so enrollment happens smoothly without last-minute troubleshooting.
Beyond technical infrastructure, configuration planning determines how users experience enrollment. You need to define enrollment profiles that specify which Setup Assistant screens users see during initial setup, establish device naming conventions that make sense for your IT team, and create department-specific configurations for different user groups. Make sure to assign these profiles in Apple Business before distributing devices so enrollment happens smoothly without last-minute troubleshooting.

## Conclusion

Expand Down
14 changes: 7 additions & 7 deletions articles/apple-mdm-setup.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

To turn on macOS, iOS, and iPadOS MDM features, follow the instructions on this page to connect Fleet to Apple Push Notification service (APNs).

To use automatic enrollment (aka zero-touch) features on macOS, iOS, and iPadOS, follow instructions to connect Fleet with Apple Business Manager (ABM).
To use automatic enrollment (aka zero-touch) features on macOS, iOS, and iPadOS, follow instructions to connect Fleet with Apple Business (AB).

To turn on Windows MDM features, head to this [Windows MDM setup article](https://fleetdm.com/guides/windows-mdm-setup).

Expand All @@ -19,7 +19,7 @@ Then select **Turn on** under the Apple (macOS, iOS, iPadOS) MDM section.
> - If your certificate expires, you must turn MDM off and back on for all macOS hosts. Until then, configuration profile changes and other MDM commands will remain stuck in “Pending.”
> - Be sure to use the same Apple ID from year-to-year. If you don't, you will have to turn MDM off and back on for all macOS hosts.

## Apple Business Manager (ABM)
## Apple Business (AB)

> Available in Fleet Premium

Expand All @@ -35,11 +35,11 @@ When one of your uploaded ABM tokens has expired or is within 30 days of expirin
To renew an ABM token:

1. Navigate to the **Settings > Integrations > Mobile device management (MDM)** page.
2. Under **Automatic enrollment**, select **Edit**, and then find the token that you want to renew. Token status is indicated in the **Renew date** column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. Select the **Actions** dropdown for the token and then select **Renew**. Follow the instructions in the modal to download a new token from Apple Business Manager and then upload the new token to Fleet.
2. Under **Automatic enrollment**, select **Edit**, and then find the token that you want to renew. Token status is indicated in the **Renew date** column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. Select the **Actions** dropdown for the token and then select **Renew**. Follow the instructions in the modal to download a new token from Apple Business and then upload the new token to Fleet.

After connecting Fleet to ABM, set Fleet to be the MDM for all Macs:

1. Log in to [Apple Business Manager](https://business.apple.com)
1. Log in to [Apple Business](https://business.apple.com)
2. Select your profile icon in the bottom left
3. Select **Preferences**
4. Select **MDM Server Assignment** and select **Edit** next to **Default Server Assignment**.
Expand All @@ -64,7 +64,7 @@ Fleet supports manually turning on MDM for macOS hosts that are already enrolled

End users can turn on MDM from their **Fleet Desktop > My device** page.

### Host is in Apple Business Manager (ABM)
### Host is in Apple Business (AB)

If a macOS host is listed in ABM:

Expand All @@ -89,15 +89,15 @@ Connect Fleet to VPP to deploy [Apple App Store apps](https://fleetdm.com/guides

1. In Fleet, select your avatar on the far right of the main navigation menu, and then **Settings > Integrations > Mobile device management (MDM)**

2. In the **Volume Purchasing Program (VPP)** section, select **Add VPP**, and then select **Add VPP** again on the following page. Follow the directions on the modal to get your VPP token from Apple Business Manager, and then select the **Upload** button at the bottom to upload it to Fleet.
2. In the **Volume Purchasing Program (VPP)** section, select **Add VPP**, and then select **Add VPP** again on the following page. Follow the directions on the modal to get your VPP token from Apple Business, and then select the **Upload** button at the bottom to upload it to Fleet.

3. To assign the VPP token to a specific fleet, find the token in the table of VPP tokens. Select the **Actions** dropdown, and then select **Edit fleets**. Use the picker to select which fleet(s) this VPP token should be assigned to.

To renew a VPP token:

1. Navigate to the **Settings > Integrations > Mobile device management (MDM)** page

2. Under **Volume Purchasing Program (VPP)**, select **Edit** and then find the token that you want to renew. Token status is indicated in the **Renew date** column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. Select the **Actions** dropdown for the token and then select **Renew**. Follow the instructions in the modal to download a new token from Apple Business Manager and then upload the new token to Fleet.
2. Under **Volume Purchasing Program (VPP)**, select **Edit** and then find the token that you want to renew. Token status is indicated in the **Renew date** column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. Select the **Actions** dropdown for the token and then select **Renew**. Follow the instructions in the modal to download a new token from Apple Business and then upload the new token to Fleet.

## Best practice

Expand Down
6 changes: 3 additions & 3 deletions articles/apple-push-notification-service-apns-mdm.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ If you're managing Apple devices, APNs isn't optional. Most of what you do on-de

The following MDM functions depend on APNs communication:

* Apps and Books management: Installations, updates, and removals from Apple Business Manager typically flow through the APNs-triggered check-in process.
* Automated Device Enrollment: After a new device activates and enrolls through Apple Business Manager, ongoing on-demand management depends on APNs.
* Apps and Books management: Installations, updates, and removals from Apple Business typically flow through the APNs-triggered check-in process.
* Automated Device Enrollment: After a new device activates and enrolls through Apple Business, ongoing on-demand management depends on APNs.
* Configuration profiles: New security settings, VPN settings, and restrictions need an APNs notification to trigger the check-in that downloads them.
* MDM commands: Lock, wipe, and restart actions only reach devices after APNs delivers the wake-up signal. If that path is blocked, these commands can sit in the queue with no visible error in your console.
* OS updates: Pushing operating system updates to managed devices uses the same APNs channel to prompt check-ins.
Expand Down Expand Up @@ -78,7 +78,7 @@ The certificate lifecycle and network requirements above apply regardless of whi

Fleet handles APNs certificate configuration as part of its [MDM setup](https://fleetdm.com/guides/macos-mdm-setup) process, covering certificate generation, upload, and renewal tracking for macOS, iOS, and iPadOS devices. Fleet also encrypts APNs-related configuration values and outlines renewal procedures within its guides.

Fleet integrates with Apple Business Manager for Automated Device Enrollment and can support multiple Apple Business Manager tokens within a single Fleet instance for managed service providers and larger enterprises.
Fleet integrates with Apple Business for Automated Device Enrollment and can support multiple Apple Business tokens within a single Fleet instance for managed service providers and larger enterprises.

Fleet has many options for migration from your current device management service. Fleet is fully compatible with Apple’s [Managed Device Migration](https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web) features and has its own [end user enabled migration workflow](https://fleetdm.com/guides/mdm-migration#end-user-workflow) built in. Fleet also supports [MDM migration](https://fleetdm.com/guides/seamless-mdm-migration) workflows that can preserve APNs and SCEP certificates. Certificate-preserving migration is not the preferred migration option for most customers. In supported scenarios, migration involves copying certificates from the existing server and retaining the same ServerURL, CheckinURL, and PushTopic values so devices typically don't need to re-enroll. In practice, this process often involves database configuration changes and load balancer redirects. Fleet's Customer Success team must assist with certificate-preserving migrations that require database manipulation for both cloud and self-hosted instances.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ Third, automated device provisioning establishes the connection between **end us

## Best practices for automated provisioning on Linux deployments

If your organization is purchasing computers directly from a large manufacturer like Dell or Lenovo, or from a 3rd party reseller like CDW or SHI, they all offer computers preinstalled with Linux. This is often the simplest and best way to start with enterprise Linux deployments. There is no MDM specification / protocol for Linux and there is no central registry for Linux computers like [Apple Business Manager (ABM)](https://support.apple.com/guide/apple-business-manager/sign-up-axm402206497/web) or [Microsoft Entra](https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra).
If your organization is purchasing computers directly from a large manufacturer like Dell or Lenovo, or from a 3rd party reseller like CDW or SHI, they all offer computers preinstalled with Linux. This is often the simplest and best way to start with enterprise Linux deployments. There is no MDM specification / protocol for Linux and there is no central registry for Linux computers like [Apple Business (AB)](https://support.apple.com/guide/apple-business-manager/sign-up-axm402206497/web) or [Microsoft Entra](https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra).

Typically, orchestration approaches are used for managing Linux devices at scale.

Expand Down
2 changes: 1 addition & 1 deletion articles/automatic-software-install-in-fleet.md
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ If the software install fails, you can reset a software automation and trigger t
![Flowchart](../website/assets/images/articles/automatic-software-install-workflow-674x189@2x.png)
*Detailed flowchart*

App Store (VPP) apps won't be installed if a host has MDM turned off or if you run out of licenses (purchased in Apple Business Manager). Currently, these errors aren't surfaced in Fleet. After turning MDM on for a host or purchasing more licenses, you can retry [installing the app on the host's **Host details** page](https://fleetdm.com/guides/deploy-software-packages#install-the-package). To retry on multiple hosts at once, head to **Policies > Manage Automations** in Fleet and turn the app's policy automation off and back on.
App Store (VPP) apps won't be installed if a host has MDM turned off or if you run out of licenses (purchased in Apple Business). Currently, these errors aren't surfaced in Fleet. After turning MDM on for a host or purchasing more licenses, you can retry [installing the app on the host's **Host details** page](https://fleetdm.com/guides/deploy-software-packages#install-the-package). To retry on multiple hosts at once, head to **Policies > Manage Automations** in Fleet and turn the app's policy automation off and back on.

Uninstalling VPP apps is [coming soon](https://github.com/fleetdm/fleet/issues/25497).

Expand Down
2 changes: 1 addition & 1 deletion articles/debunk-the-cross-platform-myth.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ By working directly with native operating system features, Fleet ensures you don
For example:

* **Operating systems**: You can enforce OS updates with Declarative Device Management (DDM), Nudge, and Windows Update from one console.
* **Automated enrollment**: Drop-ship devices to your end users with Apple Business Manager or Autopilot and let them set up their own accounts. No IT help is needed.
* **Automated enrollment**: Drop-ship devices to your end users with Apple Business or Autopilot and let them set up their own accounts. No IT help is needed.
* **Config management**: Manage settings with configuration profiles for Apple and device profiles for Windows. Use labels to test changes before they go live.
* **App management**: Automatically keep applications and plugins secure and up-to-date. Install the software end users need or let them install it themselves via self-service.
* **Scripts and events**: Easily manage and version control your custom script library. Execute shell and PowerShell scripts when computers drift from the baseline.
Expand Down
Loading